Azure architecture and services for AZ-900: the heaviest skill area, decoded

Microsoft’s study guide for the outline as of 20 July 2026 gives this area 35–40%, against 25–30% for cloud concepts and 30–35% for management and governance. Microsoft publishes weights only, not a number of questions per area, so read the range as a share of your preparation time.

Every verb in this part of the outline is describe. In practice that means matching: a stem names a need, four Azure services compete, and two of them usually differ by one word — zone or region, hot or cool, Entra ID or Entra Domain Services. Read the options before the stem. Three storage services and one networking service tell you which page of your notes you are on, and the stem only has to supply the deciding condition.

• Core architecture: regions, pairs, zones, sovereign regions, the resource hierarchy
• Compute and networking: VMs, containers, Functions, virtual networks, VPN Gateway, ExpressRoute
• Storage: services, access tiers including Cold, redundancy, migration tools
• Identity, access and security: Entra ID, Conditional Access, RBAC, Zero Trust, Defender for Cloud

Governance, cost and monitoring have their own guide, Azure management and governance. Cloud concepts is practiced on the sample questions page. All three areas side by side are on the AZ-900 syllabus page.

Questions on physical architecture are scale questions. Each construct protects against failure at one size, so the stem’s failure word picks the answer: datacenter outage points at availability zones, regional disaster at region pairs. Map that word first and two options usually fall.

The hierarchy, top to bottom

1. 1

   Management groups

   Containers for subscriptions. They can nest, and a policy or role assigned here flows down to every subscription beneath.

2. 2

   Subscriptions

   The billing and access boundary. An organization can hold several, say one per department.

3. 3

   Resource groups

   Logical containers for resources that share a lifecycle. They cannot nest, and deleting a group deletes everything in it.

4. 4

   Resources

   The VMs, storage accounts and virtual networks themselves. Each one lives in exactly one resource group.

What gets asked is direction and inheritance. Distractors flip the order (a resource group holding subscriptions), break the one-container rule (a resource in two groups), or forget that assignments higher up are inherited. One quieter detail: a resource group’s location only says where its metadata is kept, so its resources can sit in other regions.

This sub-objective splits in two. Compute questions ask which hosting option fits a level of control; networking questions ask how traffic moves between networks, offices and services. The July 2026 refresh only touched wording here (Azure virtual subnets became subnets).

Compute: find the control word

The you manage column is the elimination key. No servers to manage strikes Virtual Machines and Scale Sets in round one; a single container strikes Kubernetes. What remains is usually two adjacent rows.

Resources a VM needs: a size, an OS disk, a virtual network with a subnet and a network interface, optionally a public IP and a network security group. These are separate resources, so deleting a VM can leave its disk and network interface behind.

Networking: inside, between, and on-premises

• Virtual network: a private network in one region, divided into subnets for segmentation.
• Peering: joins virtual networks, also across regions, over Microsoft’s backbone, not the internet. It is not transitive: A to B and B to C does not link A to C.
• Azure DNS: hosts your DNS zones. It does not register domain names.
• Public endpoint: a service reachable on a public address, restrictable by firewall rules.
• Private endpoint: gives a platform service a private IP from your virtual network, so its traffic stays on Microsoft’s network.

Storage questions come in three shapes: which service holds this data, which tier suits this access pattern, which redundancy option survives this failure. A smaller fourth asks how data gets into Azure. Sort the options by shape before you read the stem closely.

Blob storage

Unstructured objects: images, video, backups, logs.

Azure Files

Managed SMB or NFS file shares, mounted like a network drive.

Queue storage

Messages that decouple parts of an application.

Table storage

A schemaless NoSQL store of keys and attributes.

Disk storage

Managed block-level disks attached to virtual machines.

Account types: standard general-purpose v2 holds blobs, files, queues and tables and suits most cases; premium accounts specialize in block blobs, file shares or page blobs (storage account overview).

Access tiers

Redundancy options

Moving and migrating data

The common miss is File Sync for a one-time move. Sync implies the local server keeps running; a one-off bulk transfer points to Data Box, a one-off server move to Azure Migrate.

Microsoft Entra ID (formerly Azure Active Directory) is Azure’s cloud identity service. Microsoft renamed Azure AD to Microsoft Entra ID in 2023 (rename notice), and the AZ-900 outline has used the Entra names since 23 January 2024. Questions here ask which control does which job: prove who someone is, decide whether to let them in, grant what they may touch, protect the workloads. Sort the options into those jobs and the odd ones out show.

Authentication

Proving who you are. Authorization, what you may do, is RBAC’s job.

Single sign-on

One identity and one sign-in for many applications.

Multifactor authentication

Factors from two or more categories: know, have, are. Two passwords are one factor.

Passwordless

Windows Hello for Business, Microsoft Authenticator, FIDO2 security keys.

External identities

Outsiders who sign in with identities they already have. Since 14 January 2026 the outline no longer names B2B and B2C.

Conditional Access

If-then policies in Entra ID: signals such as location, device and sign-in risk lead to allow, require MFA, or block.

Azure RBAC

A role, a security principal and a scope, inherited downward. Built-ins include Owner, Contributor and Reader.

When RBAC and Azure Policy appear as a pair, the question is who versus what, worked through on the management and governance guide. Here, RBAC questions mostly test scope: a role granted at a subscription reaches every resource group under it.

Zero Trust, defense in depth and Defender for Cloud

Zero Trust rests on three principles: verify explicitly, use least-privilege access, assume breach. It replaces trusting anything inside the corporate network, so internal traffic is trusted is the distractor.

Defense in depth stacks layers from the outside in: physical security, identity and access, perimeter, network, compute, application, data at the center. Questions name a control and ask its layer: DDoS protection is perimeter, network security groups are network, patching a VM is compute.

Microsoft Defender for Cloud covers security posture (a secure score, recommendations) and workload protection across Azure, other clouds and on-premises machines; it was once Azure Security Center. Microsoft Sentinel is not named in the outline, and Microsoft Purview belongs to governance.

Each trap below is a sentence that sounds right inside an option. Treat it the way you treat a distractor: find the single word that makes it false, then strike it.

Twelve original practice questions on this area, one at a time. Each is a square station on the line above the card, filled ink when right and gray when wrong; tap a station to jump. Picking an option, by click or with 1–4 or A–D, locks it, and the panel under the card shows the verdict and a note on every option: check that you struck each wrong answer for the right reason.

Then run the 60-question practice test, whose architecture and services chip filters it to this area, or read the worked examples. The home page opens with six questions across all three areas, and Microsoft’s free practice assessment is on its certification page.

Where to go next

• Study guideAZ-900 study guide: every skill Microsoft measures, weighted, with a plan to cover it
• Management and governanceAzure management and governance for AZ-900: the tools the exam expects you to tell apart
• Practice testFree AZ-900 practice test: 60 explained questions across all three skill areas
• Sample questionsAZ-900 sample questions, answered and explained